CVE-2026-73045

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An improper restriction of excessive authentication attempts exists in the 'authFilePublishAccess' endpoint. This allows unauthenticated attackers to perform brute-force attacks against per-notebook publish passwords by submitting unbounded guesses, as the system lacks rate limiting or CAPTCHA mechanisms. Successful exploitation grants unauthorized access to password-protected published notebooks.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the 'authFilePublishAccess' endpoint to minimize the risk of brute-force attacks.